Oracle Linux 10.2 on Azure User Guide

Overview

This guide covers the deployment and configuration of Oracle Linux 10.2 on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

Oracle Linux is a free, enterprise grade Linux distribution built by Oracle to be binary compatible with Red Hat Enterprise Linux 10. Oracle provides the binaries, updates and errata at no cost and permits redistribution, so there is no subscription and no licence key needed to use, patch or resell it. Version 10.2 is a current minor release in the RHEL 10 family. Oracle Linux 10 follows the RHEL 10 lifecycle and remains supported into the mid 2030s, and security backports flow into the latest minor stream, so a fully updated machine reports release 10.2 while carrying current fixes.

Oracle Linux ships two kernel lines, and this image keeps both: the Unbreakable Enterprise Kernel (UEK), an Oracle maintained kernel that boots by default, and the Red Hat Compatible Kernel (RHCK), the same 6.12 kernel line RHEL 10 uses. You can boot either.

What's included:

• Oracle Linux 10.2, binary compatible with RHEL 10
• Every available update applied at build time, bringing the base to the 10.2 point release
• Both kernel lines: Unbreakable Enterprise Kernel Release 8 (booted by default) and the Red Hat Compatible Kernel
• dnf-automatic armed, so the machine keeps applying updates on its own
• Azure Linux Agent (waagent) and cloud-init for Azure integration
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode
• BaseOS Latest, Application Stream, Addons and UEK Release 8 repositories enabled, so your update path is intact
• Gen2 Hyper V virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity and the SSH host keys are regenerated uniquely on every instance, so no two machines share a host key either.
• SELinux is left in enforcing mode, the Oracle Linux default.
• rpcbind, the RPC port mapper on port 111, is left disabled, so a fresh machine advertises only SSH. NFSv4 does not need it; if you require NFSv3 you can re enable it, as shown in the networking section.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "Oracle Linux 10.2 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-10-2-vm \
  --image cloudimg:oracle-linux:oel102:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-linux-10-2-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the Oracle Linux 10.2 release you expect:

cat /etc/oracle-release
grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release
uname -rm

Expected output:

Oracle Linux Server release 10.2
NAME="Oracle Linux Server"
VERSION="10.2"
ID="ol"
PLATFORM_ID="platform:el10"
6.12.0-204.92.4.4.3.el10uek.x86_64 x86_64

The el10uek tag on the kernel version shows the machine is running the Unbreakable Enterprise Kernel. Oracle Linux also ships the Red Hat Compatible Kernel (a 6.12 el10_2 kernel) alongside it; the next step shows both.

Step 4: Check the patch level and the two kernel lines

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are:

sudo dnf check-update
echo "exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id                repo name
ol10_UEKR8             Oracle Linux 10 UEK Release 8 (x86_64)
ol10_addons            Oracle Linux 10 Addons (x86_64)
ol10_appstream         Oracle Linux 10 Application Stream Packages (x86_64)
ol10_baseos_latest     Oracle Linux 10 BaseOS Latest (x86_64)

Both kernel lines are installed and managed by dnf. List them, and see which one is booted:

rpm -q kernel-uek-core kernel-core
uname -r

Expected output:

kernel-uek-core-6.12.0-204.92.4.4.3.el10uek.x86_64
kernel-core-6.12.0-211.43.1.el10_2.x86_64
6.12.0-204.92.4.4.3.el10uek.x86_64

The UEK line (kernel-uek-*) is the default and is what uname -r reports. The RHCK line (kernel-*, the 6.12 el10_2 kernel) is available if you prefer strict RHEL kernel compatibility; select it from the GRUB menu at boot. Both receive updates.

Because 10.2 is a current minor in the RHEL 10 family, applying updates keeps you current within the 10 series. This image also arms dnf-automatic, so updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo dnf upgrade -y

Reboot if a new kernel was installed:

sudo systemctl reboot

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, and SSH is key only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing
root L 2009-12-22 -1 -1 -1 -1 (Password locked.)
permitrootlogin without-password
pubkeyauthentication yes
passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Step 6: Verify Azure integration and unattended updates

Confirm the Azure Linux Agent, cloud-init and time synchronisation are healthy, that unattended updates are armed, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd
df -h /
free -h

Expected output:

active
enabled
/bin/cloud-init 24.4-7.0.1.el10_2.1
enabled
active
Filesystem                 Size  Used Avail Use% Mounted on
/dev/mapper/rootvg-rootlv   27G  3.3G   24G  12% /
               total        used        free      shared  buff/cache   available
Mem:           3.1Gi       572Mi       2.3Gi        16Mi       505Mi       2.6Gi
Swap:             0B          0B          0B

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. dnf-automatic.timer being enabled is what keeps the machine applying updates on its own after launch. Swap: 0B is expected: Azure manages swap on the ephemeral resource disk, so none is baked into the OS disk.

Step 7: Networking and the firewall

The Azure Network Security Group is the outer control plane for inbound and outbound traffic, and it is the first place you open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is actually listening before you open anything:

ss -tlnp

On a fresh machine the only listener is sshd on port 22. rpcbind is disabled on this image, so port 111 is closed by default.

Unlike a stock cloud image, this build also runs a host firewall. firewalld is active and enabled, using the public zone, and it already permits SSH. Inspect it with:

sudo firewall-cmd --state
sudo firewall-cmd --list-all

The public zone lists ssh among its allowed services, which is why your key based login works out of the box. To expose another service, open it in both the Azure NSG and firewalld. For example, to allow HTTPS:

sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

Always keep the ssh service allowed so a firewall change does not lock you out.

If you need NFSv3, which relies on the RPC port mapper, re enable rpcbind:

sudo systemctl enable --now rpcbind.socket

NFSv4 does not need rpcbind and works without this step.

Step 8: Install software

The BaseOS repository carries the core operating system and the Application Stream carries the application packages, so most software installs directly with dnf. Search the enabled repositories for a package:

dnf search nginx

Then install and enable it in the usual way:

sudo dnf install -y nginx
sudo systemctl enable --now nginx

Oracle Linux 10 follows the RHEL 10 model, in which the older AppStream module streams have been retired: you install the version the Application Stream ships rather than selecting a module stream. If you need a version that is not in the stock repositories, the Oracle Linux ol10_addons repository (enabled on this image) and Oracle's yum server carry additional packages.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group wheel

Common Use Cases

• RHEL 10 compatible application hosting
• Modern long lived enterprise server workloads
• A base for software certified on the Oracle Linux 10 platform
• Migration target for CentOS Stream and RHEL 10 estates

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

To see which key your client is actually offering, run ssh -v azureuser@<vm-ip> from your workstation and look for the Offering public key lines.

Azure agent not running

sudo systemctl status waagent
sudo systemctl enable --now waagent

Package manager issues

Refresh the metadata cache first:

sudo dnf clean all
sudo dnf makecache

If repositories are unreachable, check DNS resolution. getent is always present and resolves through the same system resolver:

getent hosts yum.oracle.com

Install bind-utils if you want dig and nslookup available.

A service is blocked and the logs mention SELinux

SELinux is enforcing on this image. Rather than disabling it, look at what was denied. On a healthy machine there are no recent denials, so the command reports none:

sudo ausearch -m AVC -ts recent 2>/dev/null || echo "no recent AVC denials"

Important Notes

Oracle Linux is free and open source, and Oracle explicitly permits its redistribution. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required. A paid Oracle Linux Support subscription is optional and is not needed to use, patch or resell the operating system.

Oracle Linux 10 is supported into the mid 2030s. Plan a move to a newer Oracle Linux image before that date for workloads that need to outlive it.

Oracle and Oracle Linux are trademarks of Oracle Corporation. The names are used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Oracle Corporation.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed